NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐍
🐍 PyPI
Not in CISA KEV
HIGH severity

CVE-2019-14322 — werkzeug

HIGH

CVE-2019-14322 is a high-severity (CVSS 7.5) Path Traversal vulnerability in werkzeug. 2 public exploit or proof-of-concept references are indexed, so weaponization risk is real. A fix is available for werkzeug — see the affected versions and patch details below.

Pallets Werkzeug vulnerable to Path Traversal

Also known asGHSA-j544-7q9p-6xp8PYSEC-2026-1065
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
2 known
Exploitation data as of Nov 2, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
55.8%probability of exploitation in next 30 days
High Risk0.00%
Lower risk than most CVEs99th percentile — riskier than 99% of all scored CVEsHighest risk
45.2%63.4%81.7%100.0%90.1%55.8%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

1 pkg affected
🐍werkzeug

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPIwerkzeugall versions0.15.5pip install --upgrade 'werkzeug==0.15.5'

Affected Products

1 product · 1 configurations
Application
werkzeugpalletsprojects
< 0.15.5
range
Exploits & PoCs
2

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

EDB-50101webappspython

Pallets Werkzeug 0.15.4 - Path Traversal

by faisalfs10x · Jul 6, 2021

Exploit-DB Source

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for werkzeug, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update werkzeug to 0.15.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2019-14322 is resolved across your whole dependency graph.

  3. Workarounds

    Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.

How to detect CVE-2019-14322

A community-maintained Nuclei template exists for this CVE. You can scan for it directly:

nuclei -id cve-2019-14322 -u https://target
Template
Pallets Werkzeug <0.15.5 - Local File Inclusion
Severity
high
Impact
The LFI vulnerability can lead to unauthorized access to sensitive files, potential data leakage, and remote code execution.
Remediation
Upgrade Pallets Werkzeug to version 0.15.5 or above to mitigate the LFI vulnerability.

Template by ProjectDiscovery nuclei-templates (madrobot), MIT licensed. View the full template. Scan only systems you are authorised to test.

Frequently Asked Questions

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.
O3 Security · Impact-Aware SCA

Is CVE-2019-14322 in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2019-14322: werkzeug — Fixed in 0.15.5